- unbound-control has version number in the header,

  UBCT[version]_space_ is the header sent by the client now.
- Unbound control port number is registered with IANA:
  ub-dns-control  8953/tcp    unbound dns nameserver control
  This is the new default for the control-port config setting.

git-svn-id: file:///svn/unbound/trunk@2424 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/config.h.in b/config.h.in
index 2c72be45f2c5fdde3bc4f6814a943b79af7f8ee2..b4cf52571426a395cb57fe851ad6531e73f3c5ed 100644 (file)
--- a/config.h.in
+++ b/config.h.in
@@ -871,4 +871,10 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
+/** default port for unbound control traffic, registered port with IANA,
+    ub-dns-control  8953/tcp    unbound dns nameserver control */
+#define UNBOUND_CONTROL_PORT 8953
+/** the version of unbound-control that this software implements */
+#define UNBOUND_CONTROL_VERSION 1
+
 

diff --git a/configure.ac b/configure.ac
index be5457dd99a6623b874a259970ed5e9d9b1a7f84..7d47b637b248f280b378aa455f187d7be75aec29 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -930,6 +930,12 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
+/** default port for unbound control traffic, registered port with IANA,
+    ub-dns-control  8953/tcp    unbound dns nameserver control */
+#define UNBOUND_CONTROL_PORT 8953
+/** the version of unbound-control that this software implements */
+#define UNBOUND_CONTROL_VERSION 1
+
 ])
 
 AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8])

diff --git a/daemon/remote.c b/daemon/remote.c
index 2f842be5078e0ab089f4e4c17e5bd445b79864c9..35dd0fa430b329aeef42c9201eefb7241458282e 100644 (file)
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -1871,7 +1871,8 @@ static void
 handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 {
        int r;
-       char magic[5];
+       char pre[10];
+       char magic[7];
        char buf[1024];
 #ifdef USE_WINSOCK
        /* makes it possible to set the socket blocking again. */
@@ -1880,7 +1881,7 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
 #endif
        fd_set_block(s->c->fd);
 
-       /* try to read magic UBCT string */
+       /* try to read magic UBCT[version]_space_ string */
        ERR_clear_error();
        if((r=SSL_read(ssl, magic, (int)sizeof(magic)-1)) <= 0) {
                if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN)
@@ -1888,9 +1889,10 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
                log_crypto_err("could not SSL_read");
                return;
        }
-       magic[4] = 0;
-       if( r != 4 || strcmp(magic, "UBCT") != 0) {
+       magic[6] = 0;
+       if( r != 6 || strncmp(magic, "UBCT", 4) != 0) {
                verbose(VERB_QUERY, "control connection has bad magic string");
+               /* probably wrong tool connected, ignore it completely */
                return;
        }
 
@@ -1898,6 +1900,13 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, SSL* ssl)
        if(!ssl_read_line(ssl, buf, sizeof(buf))) {
                return;
        }
+       snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
+       if(strcmp(magic, pre) != 0) {
+               verbose(VERB_QUERY, "control connection had bad "
+                       "version %s, cmd: %s", magic, buf);
+               ssl_printf(ssl, "error version mismatch\n");
+               return;
+       }
        verbose(VERB_DETAIL, "control cmd: %s", buf);
 
        /* figure out what to do */

diff --git a/doc/Changelog b/doc/Changelog
index e3a968b9650603a031a8b5627b73ac36ba758d3c..7c730c84539b5a79ca723226aa421f18b10068df 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,10 @@
+10 June 2011: Wouter
+       - unbound-control has version number in the header,
+         UBCT[version]_space_ is the header sent by the client now.
+       - Unbound control port number is registered with IANA:
+         ub-dns-control  8953/tcp    unbound dns nameserver control
+         This is the new default for the control-port config setting.
+
 30 May 2011: Wouter
        - Fix Makefile for U in environment, since wrong U is more common than
          deansification necessity.

diff --git a/doc/control_proto_spec.txt b/doc/control_proto_spec.txt
index 67bbc915db250f30235864a2b19063d1a364aedc..d26258f1ea92cf01a43ce748fbc6fb93ae8f880e 100644 (file)
--- a/doc/control_proto_spec.txt
+++ b/doc/control_proto_spec.txt
@@ -1,16 +1,21 @@
 
 Specification for the unbound-control protocol.
 
-Server listens on 953 TCP (localhost by default). Client connects,
+Server listens on 8953 TCP (localhost by default). Client connects,
 SSLv3 or TLSv1 connection setup (server selfsigned certificate, 
 client has cert signed by server certificate).
 
+Port 8953 is registered with IANA as:
+ub-dns-control  8953/tcp    unbound dns nameserver control
+# Wouter Wijngaards <wouter&nlnetlabs.nl> 10 May 2011
+On may 11 2011, ticket [IANA #442315].
+
 Query and Response
 ------------------
 Client sends 
-       UBCT [commandline] \n
-       fixed string UBCT, then an ascii text line, with a command, 
-       some whitespace allowed. Line ends with '\n'.
+       UBCT[version] [commandline] \n
+       fixed string UBCT1 (for version 1), then an ascii text line,
+       with a command, some whitespace allowed. Line ends with '\n'.
 
 Server executes command. And sends reply in ascii text over channel, 
 closes the channel when done.

diff --git a/doc/example.conf.in b/doc/example.conf.in
index 1df9bb7b860450ffc94b4b787fa6c7f42ead1518..e92d5e0c05a83e8c90e15f1bc8ddfe17ecd205fb 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -472,7 +472,7 @@ remote-control:
        # control-interface: ::1
 
        # port number for remote control operations.
-       # control-port: 953
+       # control-port: 8953
 
        # unbound server key file.
        # server-key-file: "@UNBOUND_RUN_DIR@/unbound_server.key"

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index b323f25ac0d50c09c704657233dee1115d2f458c..574f63fdbc8af42671f2331c85bb20046d853746 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -888,7 +888,7 @@ By default localhost (127.0.0.1 and ::1) is listened to.
 Use 0.0.0.0 and ::0 to listen to all interfaces.
 .TP 5
 .B control\-port: <port number>
-The port number to listen on for control commands, default is 953
+The port number to listen on for control commands, default is 8953
 (that is the same port number named uses to listen to rndc).
 If you change this port number, and permissions have been dropped, a
 reload is not sufficient to open the port again, you must then restart.

diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 6b719f84e88eb65ba6d703a852e25b7b88ec191d..a872f92aa51285d1c72779b7500137c36e202783 100644 (file)
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -258,12 +258,13 @@ send_file(SSL* ssl, FILE* in, char* buf, size_t sz)
 static int
 go_cmd(SSL* ssl, int argc, char* argv[])
 {
-       const char* pre="UBCT";
+       char pre[10];
        const char* space=" ";
        const char* newline="\n";
        int was_error = 0, first_line = 1;
        int r, i;
        char buf[1024];
+       snprintf(pre, sizeof(pre), "UBCT%d ", UNBOUND_CONTROL_VERSION);
        if(SSL_write(ssl, pre, (int)strlen(pre)) <= 0)
                ssl_err("could not SSL_write");
        for(i=0; i<argc; i++) {

diff --git a/util/config_file.c b/util/config_file.c
index 55e695f701959ba0e91c04d30bd28c63d4044570..6772a2e2dc7c895842ea5487d3a87bfcd3f573e8 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -190,7 +190,7 @@ config_create(void)
        cfg->python_script = NULL;
        cfg->remote_control_enable = 0;
        cfg->control_ifs = NULL;
-       cfg->control_port = 953;
+       cfg->control_port = UNBOUND_CONTROL_PORT;
        if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key"))) 
                goto error_exit;
        if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem")))